Black Friday and Cyber Monday scams aimed at businesses are fake invoices, delivery messages, account warnings and deals that use peak-season workload to get staff to pay, click or hand over access.

In short: Attackers use the same tricks all year, and a busy period makes them work better. The defence is a written process that holds when people are rushed, not a reminder to be careful.

Black Friday falls on 27 November 2026 and Cyber Monday on 30 November, so there is time to put checks in place before either. This post covers the main scam types, why they work on busy teams, and what a peak-season checklist should include. It needs no technical background.

What types of Black Friday and Cyber Monday scams target businesses?

Four types are worth planning for. Each one works because it looks like something your team handles every week.

The first row is the one to take most seriously, because the payment is real and your own staff make it. It is a form of business email compromise (BEC), where a fraudster uses a real or spoofed mailbox to get a genuine payment sent to the wrong account. An earlier post covers how BEC works in more detail.

Why does a busy period make staff easier to catch?

Because every one of these scams depends on a quick decision, and peak season rewards quick decisions. More invoices, parcels and orders arrive, and more of them are marked urgent. A supplier chasing payment before the deadline looks normal in November.

Cover is the second factor. Annual leave and short staffing mean the person who would usually question an odd payment may not be at their desk. The check that normally happens quietly in the background is the first thing to go.

Telling staff to be more careful does not fix this. A proper check takes time, and in a busy week nobody feels they have it. Awareness training helps, but only when it backs up a written procedure that says what to do, who signs off and what to do if the person who normally signs off is away.

What happens when staff buy or log in on work devices and accounts?

A fake shop or deal page can capture a work email address and password. If that password is reused anywhere else, one slip opens more than one account.

There are three common ways this happens in a business:

• Staff browse deals on a work laptop or phone and sign up with their work email.
• A company card is used on a site that only looks like a known supplier.
• Shared logins and shared devices, such as a warehouse terminal or a reception PC, mean one compromised password covers several people.

The controls here are plain ones:

• Turn on multi-factor authentication (MFA), a second check such as an app approval or a code, for email and for any account that can spend money.
• Use a different password for every work account.
• Set a clear rule on personal shopping on work devices.
• Limit company card use to approved suppliers.

For businesses with several sites, the shared-device point matters most. Decide who is allowed to log in where, and review it, because accounts and devices drift over time.

For staff who also shop online in their own time, last year's guide to shopping safely on Black Friday and Cyber Monday covers the basics.

What should a peak-season checklist include?

A peak-season checklist replaces judgement under pressure with fixed steps that anyone on the team can follow. The table shows what changes.

The checklist itself:

1. Call back on a number you already hold before changing any bank details. Never use the number in the message.
2. Set a payment threshold above which a second person must approve.
3. Name approvers and deputies for the whole period, including leave.
4. Make it a standing rule that an urgent request is a reason to slow down, not to skip the check.
5. Check identity before any password reset.
6. Agree one place for staff to send suspicious messages. Forward suspicious emails to the Suspicious Email Reporting Service run by the National Cyber Security Centre (NCSC) at report@phishing.gov.uk.
7. Write it down, tell everyone before 27 November, and make sure they know where to find it.

None of these steps is specific to November, which is the point. They work best when they are already how the business runs.

What should we do if a payment or login has already gone to a scam?

Phone your bank first, then deal with the accounts. Speed matters because the sooner the bank knows, the more it can try to do.

1. Call your bank straight away, using a number from its website or your card, not from the message. Ask them to try to recall the payment.
2. If a password was handed over, change it at once and sign out all active sessions. If it was an email account, check for forwarding rules or new devices the attacker may have added.
3. Tell whoever looks after your IT so they can check other accounts.
4. Check your cyber insurance policy for any duty to notify, and the time limit.
5. Keep the original message, call notes and your written procedure. Evidence that a process existed matters if you need to make a claim or a dispute.
6. Report it to Report Fraud, the City of London Police service that replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040.

Where can we find out more?

Our guide, Cyber security is a running cost, not a crisis by Matthew Dodd, is written for owners, finance directors and operations leads. It ends with twelve questions to put to whoever runs your IT. You do not need technical knowledge to use them, and every answer should be specific, evidenced and dated.

Three of the twelve apply directly to the scams in this post:

• Question 1: is multi-factor authentication enforced on every account, including administrators and shared mailboxes?
• Question 5: are SPF, DKIM and DMARC configured and enforcing on every domain we send from? These are email checks that make it harder for someone to send messages pretending to come from your domain.
• Question 6: what is our process for a supplier changing bank details, and is it written down?

entrustIT is a converged technology provider across IT, connectivity and security. You can ask the twelve questions without buying anything from us.

Frequently asked questions

What is a Black Friday scam aimed at a business?

It is a fake invoice, delivery message, account warning or deal designed to get a member of staff to pay, click or share a login during the sales period. The most costly version is a fake request to change a supplier's bank details.

How can a small business protect itself from Cyber Monday scams?

Use a written process, not a reminder to be careful. Call back on a number you already hold before changing bank details, require a second approver above a set payment amount, name deputies for anyone on leave, turn on multi-factor authentication, and agree one place to send suspicious messages.

Should staff use work email and devices for Black Friday deals?

It is safer not to. A fake deal page can capture a work email address and password, and a reused password then opens other accounts. If the business needs to buy, use approved suppliers, a unique password and multi-factor authentication.

How do I report a suspicious email or a fraud?

Forward suspicious emails to report@phishing.gov.uk, the National Cyber Security Centre's (NCSC) Suspicious Email Reporting Service. Report fraud and cyber crime to Report Fraud on 0300 123 2040. If money has left your account, call your bank first.

What should a business do if it pays a fake invoice?

Call your bank immediately and ask them to try to recall the payment. Then change any exposed passwords, tell whoever looks after your IT, check your cyber insurance policy for notification duties, keep the evidence and report it.